Path Traversal in Netapp Cloud Backup
CVE-2021-3426
There's a flaw in Python 3's pydoc. A local or adjacent attacker who discovers or is able to convince another local or adjacent user to start a pydoc server could access the server and use it to disclose sensitive information belonging to the other user that they would not normally be able to access. The highest risk of this flaw is to data confidentiality. This flaw affects Python versions before 3.8.9, Python versions before 3.9.3 and Python versions before 3.10.0a7.
Vulnerability class: Information Disclosure
EPSS: 0.019 (77.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.7 (Medium). Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Netapp Cloud_backup
- Netapp Ontap_select_deploy_administration_utility
- Netapp Snapcenter
- Oracle Communications_cloud_native_core_binding_support_function — versions 1.10.0
- Oracle Zfs_storage_appliance_kit — versions 8.8
- Python — versions 3.10.0
- Debian Debian_linux — versions 9.0
- Fedoraproject Fedora — versions 32, 33, 34
- Redhat Enterprise_linux — versions 8.0
- Redhat Software_collections
Weakness classification (CWE)
Public proof-of-concept exploits
References
- secalert@redhat.com (mailing-list, Mailing List, Third Party Advisory)
- secalert@redhat.com (vendor-advisory)
- secalert@redhat.com (vendor-advisory)
- secalert@redhat.com (vendor-advisory)
- secalert@redhat.com (vendor-advisory)
- secalert@redhat.com (vendor-advisory)
- secalert@redhat.com (vendor-advisory)
- secalert@redhat.com (vendor-advisory)
- secalert@redhat.com (vendor-advisory, Third Party Advisory)
- secalert@redhat.com (Patch, Third Party Advisory, Issue Tracking)
Frequently asked questions
- What is CVE-2021-3426?
- CVE-2021-3426 is a medium-severity vulnerability in Netapp Cloud Backup, classified under Information Disclosure. CVSS score: 5.7/10. Published 2021-05-20.
- How severe is CVE-2021-3426?
- Medium severity. CVSS v3 base score is 5.7 out of 10.
- Is CVE-2021-3426 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.